Skip to the content
The Update Bureau
SQL Server 2019 CU29 + GDR SQL Server 2019 CU29 + GDR Security update
Patch Tuesday

KB5046860

KB5046860: Security update for SQL Server 2019, CU branch, November 2024. SQL OS closes two remote-code-execution paths

In short

The update fixes two SQL OS issues that might allow remote code execution on Windows SQL Server instances and addresses 31 Important-severity vulnerabilities.

Does it affect you? Applies to: Windows x64 instances running SQL Server 2019. The listed fixes apply to Windows; the page’s Linux section points to separate instructions for updating Linux packages.

Build
15.0.4410.1
Servicing branch
CU
Security
31 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 2 changes

SQL OS

2 items

For: Windows SQL Server instances

  • Remote code execution might be possible on a SQL Server instance through a DLL planting technique; this update fixes the issue.1
    Fix applies to the SQL Server Engine on Windows.
  • A vulnerability in a SQL Server assembly might allow remote code execution; this update fixes the issue.2
    Fix applies to the SQL Server Engine on Windows.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-11-12
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5046365, KB5046060, KB5042749, KB5039747
+5 earlier KB5040948, KB5037331, KB5035123, KB5036335, KB5033688
Replaced by
KB5058722
VersionBuildChannel
2019 15.0.4410.1 General availability

Security

31 vulnerabilities fixed
31 important
VulnerabilitySeverityCVSS

The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 31 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2019
887.5 MB
sqlserver2019-kb5046860-x64.exe Main update · KB5046860 SHA-1: 618ad2ed…e98de1

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. Fixes an issue in which remote code executions might be performed by using a dynamic-link library (DLL) planting technique on a SQL Server instance. support.microsoft.com
  2. 2. Fixes an issue in which a vulnerability in a SQL Server assembly might allow remote code execution. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake